cf2db4e305a4754cf4d9799d4681b0414b556f0fd83b5760e07c88fff637cb1f | Triage

Analysis

max time kernel
148s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 08:37

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

728d03c6922988977693be59715fd52e
SHA1

5f06287f574682a844722bcded04d335fb1b9a42
SHA256

3c28c4e66a5f16e7ae2c57ca9b0c2887730d82472ac1786b641bd7744931f73b
SHA512

ebad773bb271a7648d011c8d32eea35dbc8a9f1c7c0ecca440e62fd7fb0e24fc2403b548e32f7a92bb1577abb1f25ad0d353a019f253251a56a535264797f119
SSDEEP

96:Z+PBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tzGhEl5VN:Z+pepxPE1r8/FtmCDtag5v

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4692	3568	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3568	4504	rundll32.exe	86
PID 4504 wrote to memory of 3568	4504	rundll32.exe	86
PID 4504 wrote to memory of 3568	4504	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3568 -s 612
    3⤵
    - Program crash
    PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3568 -ip 3568
1⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads